<!DOCTYPE html>
<html>
<head><meta name="generator" content="Hexo 3.8.0">
  <meta charset="utf-8">
  
  <title>Let&#39;s Encrypt | ryansecreat blog</title>
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
  <meta name="description" content="使用Let’s Encrypt生成免费SSL证书官网：Let’s Encrypt Let’s Encrypt是由互联网安全研究小组（ISRG，一个公益组织）提供的服务。提供免费、自动化、开放的证书签发服务。 Let’s Encrypt颁发的证书有期是90天，需要在过期前进行续期，好在Let’s Encrypt已经提供了自动续期的脚本。 官网推荐使用Certbot工具来部署Https证书。在Cert">
<meta name="keywords" content="https">
<meta property="og:type" content="article">
<meta property="og:title" content="Let&#39;s Encrypt">
<meta property="og:url" content="http://yoursite.com/2016/12/21/Let's Encrypt SSL/index.html">
<meta property="og:site_name" content="ryansecreat blog">
<meta property="og:description" content="使用Let’s Encrypt生成免费SSL证书官网：Let’s Encrypt Let’s Encrypt是由互联网安全研究小组（ISRG，一个公益组织）提供的服务。提供免费、自动化、开放的证书签发服务。 Let’s Encrypt颁发的证书有期是90天，需要在过期前进行续期，好在Let’s Encrypt已经提供了自动续期的脚本。 官网推荐使用Certbot工具来部署Https证书。在Cert">
<meta property="og:locale" content="zh-Hans">
<meta property="og:updated_time" content="2019-07-26T08:35:17.299Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="Let&#39;s Encrypt">
<meta name="twitter:description" content="使用Let’s Encrypt生成免费SSL证书官网：Let’s Encrypt Let’s Encrypt是由互联网安全研究小组（ISRG，一个公益组织）提供的服务。提供免费、自动化、开放的证书签发服务。 Let’s Encrypt颁发的证书有期是90天，需要在过期前进行续期，好在Let’s Encrypt已经提供了自动续期的脚本。 官网推荐使用Certbot工具来部署Https证书。在Cert">
  
    <link rel="alternate" href="/atom.xml" title="ryansecreat blog" type="application/atom+xml">
  
  
    <link rel="icon" href="/favicon.png">
  
  

  
  <link rel="stylesheet" href="/css/style.css">
  

</head>
</html>
<body>
  <div id="container">
    <div id="wrap">
      <header id="header">
  <div id="banner"></div>
  <div id="header-outer" class="outer">
    <div id="header-title" class="inner">
      <h1 id="logo-wrap">
        <a href="/" id="logo">ryansecreat blog</a>
      </h1>
      
        <h2 id="subtitle-wrap">
          <a href="/" id="subtitle">smile hard</a>
        </h2>
      
    </div>
    <div id="header-inner" class="inner">
      <nav id="main-nav">
        <a id="main-nav-toggle" class="nav-icon"></a>
        
          <a class="main-nav-link" href="/">Home</a>
        
          <a class="main-nav-link" href="/archives">Archives</a>
        
      </nav>
      <nav id="sub-nav">
        
          <a id="nav-rss-link" class="nav-icon" href="/atom.xml" title="RSS Feed"></a>
        
        <a id="nav-search-btn" class="nav-icon" title="Search"></a>
      </nav>
      <div id="search-form-wrap">
        <form action="//google.com/search" method="get" accept-charset="UTF-8" class="search-form"><input type="search" name="q" class="search-form-input" placeholder="Search"><button type="submit" class="search-form-submit">&#xF002;</button><input type="hidden" name="sitesearch" value="http://yoursite.com"></form>
      </div>
    </div>
  </div>
</header>
      <div class="outer">
        <section id="main"><article id="post-Let&#39;s Encrypt SSL" class="article article-type-post" itemscope="" itemprop="blogPost">
  <div class="article-meta">
    <a href="/2016/12/21/Let's Encrypt SSL/" class="article-date">
  <time datetime="2016-12-21T03:47:39.000Z" itemprop="datePublished">2016-12-21</time>
</a>
    
  </div>
  <div class="article-inner">
    
    
      <header class="article-header">
        
  
    <h1 class="article-title" itemprop="name">
      Let&#39;s Encrypt
    </h1>
  

      </header>
    
    <div class="article-entry" itemprop="articleBody">
      
        <h3 id="使用Let’s-Encrypt生成免费SSL证书"><a href="#使用Let’s-Encrypt生成免费SSL证书" class="headerlink" title="使用Let’s Encrypt生成免费SSL证书"></a>使用Let’s Encrypt生成免费SSL证书</h3><p>官网：<a href="https://letsencrypt.org/" target="_blank" rel="noopener">Let’s Encrypt</a></p>
<p>Let’s Encrypt是由互联网安全研究小组（ISRG，一个公益组织）提供的服务。提供免费、自动化、开放的证书签发服务。</p>
<p>Let’s Encrypt颁发的证书有期是90天，需要在过期前进行续期，好在Let’s Encrypt已经提供了自动续期的脚本。</p>
<p>官网推荐使用<a href="https://certbot.eff.org/" target="_blank" rel="noopener">Certbot</a>工具来部署Https证书。在Certbot首页上选择Web服务器及服务器OS类型，我们在这里以Nginx + CentOS 6为例来说明。</p>
<p>原文链接：<a href="https://certbot.eff.org/#centos6-nginx" target="_blank" rel="noopener">https://certbot.eff.org/#centos6-nginx</a></p>
<ol start="0">
<li><h4 id="生成证书"><a href="#生成证书" class="headerlink" title="生成证书"></a>生成证书</h4><ol start="0">
<li><p>安装证书生成工具certbot-auto：</p>
 <figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">wget https://dl.eff.org/certbot-auto</span><br><span class="line">chmod a+x certbot-auto</span><br></pre></td></tr></table></figure>
</li>
<li><p>安装依赖</p>
<p> 运行<figure class="highlight plain"><figcaption><span>Command Not Found```，需要[安装pip](https://pip.pypa.io/en/stable/installing/)、virtualenv包：```pip install virtualenv```。</span></figcaption><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line">0. 配置Nginx</span><br><span class="line">	</span><br><span class="line">	为需要配置https的站点添加以下配置，将访问/.well-known的请求指向本地目录。Let&apos;s Encrypt在生成证书的过程中，会在/var/www/www.xxx.com/.well-known目录生成一个临时文件，并且会访问类似于http://www.xxx.com/.well-known/acme-challenge/HGr8U1IeTW4kY_Z6UIyaakzOkyQgPr_7ArlLgtZE8SX的url，来检查域名配置是否有效。</span><br><span class="line"></span><br><span class="line">	添加以下配置，并重启Nginx：nginx -s reload，如果reload不生效，可以试试restart。</span><br></pre></td></tr></table></figure></p>
<p> server {</p>
<pre><code>...            

location /.well-known {
    alias /var/www/www.xxx.com/.well-known;
}

...
</code></pre><p> }</p>
 <figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line">		*即使证书生成之后，也需要保留Nginx的这一个配置，因为证书的续期还需要这一个配置。*</span><br><span class="line"></span><br><span class="line">	0. 通过向导生成证书</span><br><span class="line"></span><br><span class="line">		运行```./certbot-auto certonly```，会通过向导方式一步一步来生成证书。过程中间会用到上一步在Nginx中配置的本地目录。</span><br><span class="line"></span><br><span class="line">		**对证书生成过程和原理比较熟悉的话，可以不使用向导方式，直接使用certbot-auto命令```./certbot-auto certonly --webroot -w /var/www/www.xxx.com -d xxx.com -d www.xxx.com -w /var/www/thing -d thing.is -d m.thing.is```可以快速高效地生成证书**</span><br><span class="line"></span><br><span class="line">		生成的证书默认在/etc/letsencrypt/live/www.xxx.com/目录。</span><br><span class="line"></span><br><span class="line">0. #### 配置Nginx使用证书</span><br><span class="line"></span><br><span class="line">	添加以下配置，并重启Nginx：```nginx -s reload```，如果reload不生效，可以试试restart。</span><br></pre></td></tr></table></figure>
<p>server {</p>
<p> …<br> listen 443;</p>
<p> ssl on;<br> ssl_stapling_verify on;<br> ssl_certificate         /etc/letsencrypt/live/<a href="http://www.xxx.com/fullchain.pem" target="_blank" rel="noopener">www.xxx.com/fullchain.pem</a>;<br> ssl_certificate_key     /etc/letsencrypt/live/<a href="http://www.xxx.com/privkey.pem" target="_blank" rel="noopener">www.xxx.com/privkey.pem</a>;</p>
<p> …</p>
<p>}</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line">0. #### 检查证书的有效性</span><br><span class="line"></span><br><span class="line">	打开浏览器，检查证书的有效性。</span><br><span class="line"></span><br><span class="line">0. #### 证书续期</span><br><span class="line"></span><br><span class="line">	Let&apos;s Encrypt颁发的证书有期是90天，需要在过期前进行续期，好在Let&apos;s Encrypt已经提供了自动续期的脚本。</span><br><span class="line"></span><br><span class="line">	官网说明，可以一天调用两次，如果检测到证书不需要更新，是什么都不做的，以减少意外造成的故障。</span><br><span class="line"></span><br><span class="line">	先运行```certbot-auto renew --dry-run```命令检查证书自动续期是否正常，如果正常，将```certbot-auto renew --quiet```命令添加到系统的计划任务cron中，就可以实现证书自动续期了。</span><br></pre></td></tr></table></figure>
<p>01 1 <em> </em> * ./path/to/certbot-auto renew –quiet<br><code>`</code><br>表示每天的1点1分自动执行续期脚本。</p>
</li>
</ol>
</li>
</ol>

      
    </div>
    <footer class="article-footer">
      <a data-url="http://yoursite.com/2016/12/21/Let's Encrypt SSL/" data-id="ck3ya0yhs00070d8sokikmltk" class="article-share-link">Share</a>
      
      
  <ul class="article-tag-list"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/https/">https</a></li></ul>

    </footer>
  </div>
  
    
<nav id="article-nav">
  
    <a href="/2016/12/25/eslint/" id="article-nav-newer" class="article-nav-link-wrap">
      <strong class="article-nav-caption">Newer</strong>
      <div class="article-nav-title">
        
          eslint
        
      </div>
    </a>
  
  
    <a href="/2016/12/21/hexo/" id="article-nav-older" class="article-nav-link-wrap">
      <strong class="article-nav-caption">Older</strong>
      <div class="article-nav-title">hexo</div>
    </a>
  
</nav>

  
</article>

</section>
        
          <aside id="sidebar">
  
    

  
    
  <div class="widget-wrap">
    <h3 class="widget-title">Tags</h3>
    <div class="widget">
      <ul class="tag-list"><li class="tag-list-item"><a class="tag-list-link" href="/tags/css/">css</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/docker/">docker</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/es/">es</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/eslint/">eslint</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/git/">git</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/hexo/">hexo</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/http/">http</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/https/">https</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/interview/">interview</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/loadtest/">loadtest</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/ops/">ops</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/pattern/">pattern</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/pm2/">pm2</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/postgre/">postgre</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/regex/">regex</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/ts/">ts</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/useful-package/">useful package</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/vue-eventloop-js/">vue eventloop js</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/web-安全/">web 安全</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/webpack/">webpack</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/安全/">安全</a></li><li class="tag-list-item"><a class="tag-list-link" href="/tags/零碎/">零碎</a></li></ul>
    </div>
  </div>


  
    
  <div class="widget-wrap">
    <h3 class="widget-title">Tag Cloud</h3>
    <div class="widget tagcloud">
      <a href="/tags/css/" style="font-size: 10px;">css</a> <a href="/tags/docker/" style="font-size: 10px;">docker</a> <a href="/tags/es/" style="font-size: 20px;">es</a> <a href="/tags/eslint/" style="font-size: 10px;">eslint</a> <a href="/tags/git/" style="font-size: 10px;">git</a> <a href="/tags/hexo/" style="font-size: 10px;">hexo</a> <a href="/tags/http/" style="font-size: 10px;">http</a> <a href="/tags/https/" style="font-size: 10px;">https</a> <a href="/tags/interview/" style="font-size: 10px;">interview</a> <a href="/tags/loadtest/" style="font-size: 10px;">loadtest</a> <a href="/tags/ops/" style="font-size: 10px;">ops</a> <a href="/tags/pattern/" style="font-size: 10px;">pattern</a> <a href="/tags/pm2/" style="font-size: 10px;">pm2</a> <a href="/tags/postgre/" style="font-size: 10px;">postgre</a> <a href="/tags/regex/" style="font-size: 10px;">regex</a> <a href="/tags/ts/" style="font-size: 10px;">ts</a> <a href="/tags/useful-package/" style="font-size: 10px;">useful package</a> <a href="/tags/vue-eventloop-js/" style="font-size: 10px;">vue eventloop js</a> <a href="/tags/web-安全/" style="font-size: 10px;">web 安全</a> <a href="/tags/webpack/" style="font-size: 10px;">webpack</a> <a href="/tags/安全/" style="font-size: 10px;">安全</a> <a href="/tags/零碎/" style="font-size: 10px;">零碎</a>
    </div>
  </div>

  
    
  <div class="widget-wrap">
    <h3 class="widget-title">Archives</h3>
    <div class="widget">
      <ul class="archive-list"><li class="archive-list-item"><a class="archive-list-link" href="/archives/2019/12/">December 2019</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2019/11/">November 2019</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2019/08/">August 2019</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2019/07/">July 2019</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2019/06/">June 2019</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2019/05/">May 2019</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2019/04/">April 2019</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2019/02/">February 2019</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2017/02/">February 2017</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2017/01/">January 2017</a></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2016/12/">December 2016</a></li></ul>
    </div>
  </div>


  
    
  <div class="widget-wrap">
    <h3 class="widget-title">Recent Posts</h3>
    <div class="widget">
      <ul>
        
          <li>
            <a href="/2019/12/09/security-1/">security</a>
          </li>
        
          <li>
            <a href="/2019/11/08/encoding/">encoding</a>
          </li>
        
          <li>
            <a href="/2019/08/23/graphql/">graphql</a>
          </li>
        
          <li>
            <a href="/2019/07/02/linux/">linux</a>
          </li>
        
          <li>
            <a href="/2019/07/02/es8/">es8</a>
          </li>
        
      </ul>
    </div>
  </div>

  
</aside>
        
      </div>
      <footer id="footer">
  
  <div class="outer">
    <div id="footer-info" class="inner">
      &copy; 2019 ryansecreat<br>
      Powered by <a href="http://hexo.io/" target="_blank">Hexo</a>
    </div>
  </div>
</footer>
    </div>
    <nav id="mobile-nav">
  
    <a href="/" class="mobile-nav-link">Home</a>
  
    <a href="/archives" class="mobile-nav-link">Archives</a>
  
</nav>
    

<script src="//cdn.jsdelivr.net/npm/jquery@3.2.1/dist/jquery.min.js"></script>


  <link rel="stylesheet" href="/fancybox/jquery.fancybox.css">
  <script src="/fancybox/jquery.fancybox.pack.js"></script>


<script src="/js/script.js"></script>

  </div>
</body>
</html>